I was doing some research into some possible search performance tuning within my cluster, and I noticed that the Elastic Agent integrations don't leverage sorting the index on
@timestamp. In release 7.6, Elastic made a big deal on the performance advances they made when using sorting on date fields. While I understand that at the time this wasn't easily implementable, since beats exist, and since they all used the same index, and with the limitations of sorting (can't use nested fields), this would be pretty much impossible; with the implementation of Integrations and data streams, why hasn't
@timestamp been applied at the individual data stream level?
While I don't have any real performance numbers to determine whether the trade-off of implementing sorting on
@timestamp is worth it, I'm more just curious if this has even been considered for Integrations?